Subject: RE: [mobile-ip] SA b/w MN and HA of foreign n/w(smooth handoff case)

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 18 Sep 2002 09:37:21 -0700

Alper,

> 
> Another relevant piece can be PANA.
> It's used in authenticating (and authorizing)
> clients for network access. When this protocol
> is used, mobile node would implement PANA client,
> and routers would implement the PANA authentication
> agent. One can bootstrap a trust relation between these 
> entities upon successful PANA exchange. Some additional 
> things need to be worked out for turning this relation into a 
> security association for Mobile IP or neighbor discovery uses..
> 
I am not sure how you will use it for neighbor discovery, as you
would have done neighbor discovery during your PANA exchange. Or
you are assuming that you learnt the link layer address of the
access router from the unprotected RA ?

-mohan

> alper
> 
> 
> ----- Original Message -----
> From: "James Kempf" <[email-masked]>
> To: "Jari Arkko" <[email-masked]>; 
> <[email-masked]>
> Cc: <[email-masked]>
> Sent: Tuesday, September 17, 2002 9:45 AM
> Subject: Re: [mobile-ip] SA b/w MN and HA of foreign 
> n/w(smooth handoff
> case)
> 
> 
> > Jari,
> >
> > There's another consideration here.
> >
> > If the SEND (SEcuring Neighbor Discovery) work successfully 
> concludes, 
> > it
> should
> > be possible to set up a security association between any 
> IPv6 router 
> > and a
> host,
> > in some fashion. This would apply to a mobile node and an access 
> > router as
> well.
> >
> > SEND would be an excellent alternative to requiring the 
> same level of
> security
> > as with a home agent. This is another reason why I think it would be
> better to
> > move forwarding from previous care of address into the fast handoff 
> > draft.
> It is
> > currently cast as a "on link home agent" but it really has 
> to do with 
> > the
> access
> > router. Recognizing that, and designing the security to properly 
> > account
> for the
> > kinds of threats that that entails, is necessary. SEND and the fast
> handover
> > work are complementary.
> >
> >             jak
> >
> >
> > ----- Original Message -----
> > From: "Jari Arkko" <[email-masked]>
> > To: <[email-masked]>
> > Cc: <[email-masked]>
> > Sent: Tuesday, September 17, 2002 1:16 AM
> > Subject: Re: [mobile-ip] SA b/w MN and HA of foreign n/w(smooth 
> > handoff
> case)
> >
> >
> > > [email-masked] wrote:
> > >
> > > >  In the section 14.3 ("Security features: Binding 
> updates to Home
> agents"),
> > > > it has been mentioned that  for forwarding from a 
> previous care-of
> address
> > > > "a prearranged security association must exist b/w MN and the
> temporary
> > > > home agent" i.e. if we want to support smooth hand-off there 
> > > > should be
> a SA
> > > > existing b/w the MN and HA of foreign network.
> > > > How is this SA arranged? is this manually done by the 
> > > > administrator or
> is
> > > > this achieved using IKE?
> > >
> > > This is the subject of the debate under the heading 
> "Mobile IPv6 - 
> > > Issue
> 72
> > > (Forwarding from Previous CoA)".
> > >
> > > In the basic mobile node - home agent case there's some published 
> > > text
> on
> > > how to set up the manual SAs and policy entries (the URL 
> is in the 
> > > mail sent by Kevin Miles). IKE wasn't considered in this 
> note, but 
> > > I'm
> working
> > > together with Vijay and Francis to produce an updated 
> note in draft 
> > > form about this.
> > >
> > > For the previous-router-become-temp-ha case there are some 
> > > additional issues, which I listed in the discussion 
> mentioned above. 
> > > Copying from there:
> > >
> > >     One problem is that the number of SAs in the manual case
> > >     grows unreasonably large when each MN needs an SA to every
> > >     place where it might possibly go to. This also applies to
> > >     the address-specific policy data base that we need even if
> > >     dynamic keying is used. In the multiple-HA case the size
> > >     of the necessary data bases is proportional to the number
> > >     of home addresses. In the prev-coa-forwarding case its
> > >     proportional to the number of interface IDs times the
> > >     number of prefixes.
> > >
> > >     Since all of this is pretty much based on addresses, we
> > >     need to ensure address uniqueness even for care-of addresses
> > >     on the whole network and not just at one link. There may be
> > >     other issues that we haven't thought of.
> > >
> > > Jari
> > >
> > >
> > >
> > >
> >
> >
> 
>

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Wed, 18 Sep 2002 18:47:19 -0700

RE: [mobile-ip] SA b/w MN and HA of foreign n/w(smooth handoff case)
Mohan,

If we let PANA work before IP address configuration
(i.e., using unspecified IP address as source on the client),
then this should work. This is akin to use of unspecified 
IP address in DHCP and Mobile IPv4. Link-layer and IP
address of the PAA/router can be learned during "discovery"
stage.

alper

  ----- Original Message ----- 
  From: Mohan Parthasarathy 
  To: Alper E. YEGIN ; James Kempf ; Jari Arkko ; [email-masked] 
  Cc: [email-masked] 
  Sent: Wednesday, September 18, 2002 9:37 AM
  Subject: RE: [mobile-ip] SA b/w MN and HA of foreign n/w(smooth handoff case)

  Alper, 

  -mohan